From nobody Wed Aug 13 21:48:22 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C43011A011E for ; Wed, 13 Aug 2014 21:48:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HN6OaFAI-eJH for ; Wed, 13 Aug 2014 21:48:19 -0700 (PDT) Received: from mail-we0-x22a.google.com (mail-we0-x22a.google.com [IPv6:2a00:1450:400c:c03::22a]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E86901A00EF for ; Wed, 13 Aug 2014 21:48:18 -0700 (PDT) Received: by mail-we0-f170.google.com with SMTP id w62so572028wes.15 for ; Wed, 13 Aug 2014 21:48:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:content-type:message-id:mime-version:subject:date:references :to:in-reply-to; bh=DBTbZ3RSLuhRxNRcUskTxuJIuIck2HbU/zCFIMVPpFw=; b=xNyDhOfdVTKnkmKfI5/UzisyPkeasREY+WdTMEw1mHsrYERz0U2bh+raRqIs34kFB/ jD3Txhi7HbdcYmcnyL66mIIuBKpUhy+h4tIDLF0AtQiynbUOguTbbfzQ3UcTjPYhRS4q JS1X4KNN/DstBhJJYzFQsegskyYL8kus8F6ct5FDctT+qVDcz3OzcaxWgn37kzBe45u/ W6+jvIBHDzpTq8oOKEB6jpsa0O/Tb4/5OuGGAsGIQ7UWj3zvcj04bm9shMEXLD5nVXrY jn2pbRQpsqgPKbsY0y9g0GhWIfuMLz9/3FkPZddnHVYaBfVSEQ+fpA/rcU6B0UbsI/uF Z4VA== X-Received: by 10.180.38.84 with SMTP id e20mr8772598wik.43.1407991697528; Wed, 13 Aug 2014 21:48:17 -0700 (PDT) Received: from [192.168.1.103] (bzq-84-109-50-18.red.bezeqint.net. [84.109.50.18]) by mx.google.com with ESMTPSA id fr4sm15768774wic.16.2014.08.13.21.48.16 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 13 Aug 2014 21:48:17 -0700 (PDT) From: Yoav Nir Content-Type: multipart/alternative; boundary="Apple-Mail=_A19FC3D9-193C-46ED-B476-9B466AC7D5B9" Message-Id: <82EA5C58-0A89-4077-BBF4-68E9367E3CE6@gmail.com> Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Date: Thu, 14 Aug 2014 07:48:15 +0300 References: <3DD81803-39CF-42D7-AB71-CC3813E7EDAB@gmail.com> To: IETF HTTP Auth In-Reply-To: <3DD81803-39CF-42D7-AB71-CC3813E7EDAB@gmail.com> X-Mailer: Apple Mail (2.1878.6) Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/D_G_ywulV2afkFmjbbKEnOSxGys Subject: Re: [http-auth] Modifications to Basic & Digest X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Aug 2014 04:48:20 -0000 --Apple-Mail=_A19FC3D9-193C-46ED-B476-9B466AC7D5B9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Hi folks Based on both the responses to this thread and previous threads about = specific enhancements, I think we can call this. There were no posts saying that we absolutely should not make any = changes to Basic and Digest. There were some people who said these = changes were worthwhile, and others who thought it didn=92t add much. = There were none in the =93this makes things worse=94 camp. So I think we can call consensus on allowing changes (in general). About the two proposals for changes: 1. Add username hashing to Digest: there are more people who want this = than there are people who care enough to say that they don=92t care. = There is also some implementation and deployment experience. And it also = serves a privacy purpose by reducing the amount of personal information = sent over the wire. So I think we can call this as accepted by the = group. Since this modification is already in the draft, there are no = action items here for Rifaat, David, and Sophie. 2. Adding username suggestion by the server to Basic. So far I only see = one person advocating it. Anyone else? If people in the group think I=92m misreading this, please let us know = on-list soon. Thanks Yoav On Jul 24, 2014, at 6:24 PM, Yoav Nir wrote: > Hi >=20 > A question we raised at the HTTP-Auth meeting today was whether or not = we=92d like to make any changes to Basic and Digest. >=20 > The charter requires us to add to things to these protocols: > Adding internationalization support for user names and passwords > Adding modern hash functions to Digest so that an implementation does = not depend on MD5. >=20 > There are a few additional extensions proposed. The Digest draft = includes optional username hashing, which (when used) will prevent the = cleartext username from being sent on the wire. This sounds (to me) to = be a good idea privacy-wise, but there is a claim that Basic and Digest = are so horribly broken anyway, that we don=92t want to add security = features to them, even if said security features seem like a good idea = (hence the =93lipstick on a pig=94 comment I made at the session [1]). >=20 > So the question I=92m asking the group here is, do we want to tinker = with Basic and Digest, potentially making them somewhat better, or do we = want to clamp down on all such discussion, and stick only to the = mandates in the charter? >=20 > Yoav >=20 > [1] > --Apple-Mail=_A19FC3D9-193C-46ED-B476-9B466AC7D5B9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 Hi = folks

Based on both the responses to this thread and = previous threads about specific enhancements, I think we can call = this.

There were no posts saying that we = absolutely should not make any changes to Basic and Digest. There were = some people who said these changes were worthwhile, and others who = thought it didn=92t add much. There were none in the =93this makes = things worse=94 camp.

So I think we can call = consensus on allowing changes (in = general).

About the two proposals for = changes:

1. Add username hashing to Digest: = there are more people who want this than there are people who care = enough to say that they don=92t care. There is also some implementation = and deployment experience. And it also serves a privacy purpose by = reducing the amount of personal information sent over the wire. So I = think we can call this as accepted by the group. Since this modification = is already in the draft, there are no action items here for Rifaat, = David, and Sophie.

2. Adding username = suggestion by the server to Basic. So far I only see one person = advocating it. Anyone else?

If people in the = group think I=92m misreading this, please let us know on-list = soon.

Thanks

Yoav
<= div>
On Jul 24, 2014, at 6:24 PM, Yoav Nir <ynir.ietf@gmail.com> = wrote:

Hi

A question we raised at the = HTTP-Auth meeting today was whether or not we=92d like to make any = changes to Basic and Digest.

The charter = requires us to add to things to these protocols:
  1. Adding internationalization support for user = names and passwords
  2. Adding modern hash functions to Digest so = that an implementation does not depend on = MD5.

There are a few additional = extensions proposed. The Digest draft includes optional username = hashing, which (when used) will prevent the cleartext username from = being sent on the wire. This sounds (to me) to be a good idea = privacy-wise, but there is a claim that Basic and Digest are so horribly = broken anyway, that we don=92t want to add security features to them, = even if said security features seem like a good idea (hence the = =93lipstick on a pig=94 comment I made at the session = [1]).

So the question I=92m asking the group = here is, do we want to tinker with Basic and Digest, potentially making = them somewhat better, or do we want to clamp down on all such = discussion, and stick only to the mandates in the = charter?

Yoav

[1]
<= div>
<lipstick_pig_080910_mn1.jpg>

= --Apple-Mail=_A19FC3D9-193C-46ED-B476-9B466AC7D5B9-- From nobody Thu Aug 14 03:37:59 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2002E1A07D0 for ; Thu, 14 Aug 2014 03:37:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.967 X-Spam-Level: X-Spam-Status: No, score=-4.967 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.668, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rEm0takrsBg9 for ; Thu, 14 Aug 2014 03:37:54 -0700 (PDT) Received: from mail-in5.apple.com (mail-out5.apple.com [17.151.62.27]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75AEB1A098B for ; Thu, 14 Aug 2014 03:37:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=apple.com; s=mailout2048s; c=relaxed/simple; q=dns/txt; i=@apple.com; t=1408012673; x=2271926273; h=From:Sender:Reply-To:Subject:Date:Message-id:To:Cc:MIME-version:Content-type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-reply-to:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=yHYX+cDJWcfzZlo95FS4xQc3DM90ZNpfvHJxNo0LrCc=; b=kzUlEXHG0HetPDp6t4XqZgX1Fh8t+HcBQwSZ32vstI//SFuRpGxIGSdl/N7cRFQO 432FQf6tw8w9w4gXPeLjAj5elumNRFOIWqXmUTWZNoog/XcfGhpzwjX3jLUAHnmh GXAvQEXWDOVUbYrKlSX7Yo54jWWJSkut/pEAJ5fLSXPlw8sFSAHmOJrSQPi/P/Cb P3SAgR5B/QVy2w3QNghJDjEeloG7T9BDWX/MRUX9CUu3iALGELM4FATMHyD69MY7 L6Ow7RdSEayY9Y+8XEtgW/cqFQkv7za6Xx5KszjThfLiHbwgsSooE74JQQwokvE2 vuHtLbGo1hwmLyYAcHULEQ==; Received: from mail-out.apple.com (mail-out.apple.com [17.151.62.50]) (using TLS with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by mail-in5.apple.com (Apple Secure Mail Relay) with SMTP id 9B.8E.27919.1819CE35; Thu, 14 Aug 2014 03:37:53 -0700 (PDT) MIME-version: 1.0 Content-type: multipart/alternative; boundary="Boundary_(ID_EcH1UPVQwHVtDE/1tWH4xg)" Received: from relay4.apple.com ([17.128.113.87]) by local.mail-out.apple.com (Oracle Communications Messaging Server 7.0.5.30.0 64bit (built Oct 22 2013)) with ESMTP id <0NAA009FQLJ14130@local.mail-out.apple.com> for http-auth@ietf.org; Thu, 14 Aug 2014 03:37:53 -0700 (PDT) X-AuditID: 11973e13-f79656d000006d0f-e3-53ec9181cece Received: from ma1-phonehomebzp-sz01.apple.com (ma1-phonehomebzp-sz01.apple.com [17.171.2.47]) (using TLS with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by relay4.apple.com (Apple SCV relay) with SMTP id 5E.01.03493.5819CE35; Thu, 14 Aug 2014 03:37:57 -0700 (PDT) Received: from [25.127.91.223] (unknown [24.114.61.30]) by ma1-phonehomebzp-sz01.apple.com (Oracle Communications Messaging Server 7.0.5.30.0 64bit (built Oct 22 2013)) with ESMTPSA id <0NAA001A6LJ2AW10@ma1-phonehomebzp-sz01.apple.com> for http-auth@ietf.org; Thu, 14 Aug 2014 03:37:51 -0700 (PDT) From: Mike Sweet X-Mailer: iPhone Mail (11D257) In-reply-to: <82EA5C58-0A89-4077-BBF4-68E9367E3CE6@gmail.com> Date: Thu, 14 Aug 2014 06:37:51 -0400 Message-id: <7D09994D-5C35-4FF4-9F4F-5A8E1D11D9E7@apple.com> References: <3DD81803-39CF-42D7-AB71-CC3813E7EDAB@gmail.com> <82EA5C58-0A89-4077-BBF4-68E9367E3CE6@gmail.com> To: Yoav Nir X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrKLMWRmVeSWpSXmKPExsUiON3OSLdx4ptggxPb2S0+7J/D5MDosWTJ T6YAxigum5TUnMyy1CJ9uwSujMWTlrMXHLKt+LF5I3MDY6NJFyMnh4SAiUTb/YmMELaYxIV7 69m6GLk4hARmMUn8Ov4fLMErICjxY/I9FhCbWSBM4sT+ZiaIoplMEh/WHGCGmXS6+xULRGI1 k0T7oknsEM5GJoljcy4CtXBwCAtYSExq8ARpYBNQlpjfM4EJollO4sS/52wgNqeArUTHvvdg cRYBVYmz956yQ2xWl1g+5QUzyBheARuJD9PqQcJCAvkSN34vAbtBREBJ4vCVr8wgayUEZrFJ LPlyim0Co/AsJE/MQvLELKBRIGOnTMmFCGtLPHl3gRXCVpNY+HsRE7L4Aka2VYxCuYmZObqZ eaZ6iQUFOal6yfm5mxgh8SC8g/H0KqtDjAIcjEo8vB5Rr4OFWBPLiitzDzFKc7AoifNu/QEU EkhPLEnNTk0tSC2KLyrNSS0+xMjEwSnVwChQJpl8qvyV4ZVvXzPVJnIzdVQx5pbKKceULuMM Y71wem0Is6dfYLDl7pPsq35pPSq+6VZg/1b44g7J5wZ9CQc8C/ex/tef131Ldvo8beGVWy0X B39N0Nds1P3o8nP/rDnS347W5bjs+3pUfsnif5WzrIzSt2x8cnR7Us3p9nbd7MsFH9ekRimx FGckGmoxFxUnAgApw4c/aAIAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrCLMWRmVeSWpSXmKPExsUiuJpJX7d14ptgg8YrehYf9s9hcmD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxqvjr5gKnttW7Lm5ibWBcZFJFyMnh4SAicTp7lcsELaYxIV7 69m6GLk4hARWMkmcfDSNBcLZyCRxbM5FJpAqZoF4iT+zOxhBbF4BcYnXR6cA2RwcwgIWEpMa PEHCbALKEvN7JjBBDJWTOPHvORuIzSlgK9Gx7z1YnEVAVeLsvafsECPVJZZPecEMYctLbF7z lhlkJK+AjcSHafUgYSGBfIkbv5eAlYgIKEkcvvKVeQKjwCwkB81CctAsJJMgbE2J/d3LWSBs bYllC19DxTUkOr9NZEUWX8DIvopRoCg1J7HSRC+xoCAnVS85P3cTIyisGwrDdzD+W2Z1iFGA g1GJh9cj6nWwEGtiWXFl7iFGCQ5mJRHeVb1vgoV4UxIrq1KL8uOLSnNSiw8xSnOwKInz5q5/ FSwkkJ5YkpqdmlqQWgSTZeLglGpgTF2XzaOziXnJC6Fp665e7nzc6P1QMH6NxLIfOvJPxCV8 pk92X1Kc9OM0G2/j+znilXd6xZqvfJJWf8kwgXVu4sSPH85E/Y+fsTe2Qb7Uoq7xyf5dTObG Di9v1e5I+9Nts78yXuV1h8D6xH86p+6t7jp3PoXtydvUwq9WFn/O/4lPX2+QleY2WYmlOCPR UIu5qDgRAPcoP/ZnAgAA Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/IjkIhgccY3_VldVUzVHv8E3dJO4 Cc: IETF HTTP Auth Subject: Re: [http-auth] Modifications to Basic & Digest X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Aug 2014 10:37:57 -0000 --Boundary_(ID_EcH1UPVQwHVtDE/1tWH4xg) Content-type: text/plain; charset=utf-8 Content-transfer-encoding: quoted-printable If we don't add the username parameter to Basic, then I'd just like to ask t= hat the current draft be updated to allow additional parameters to be passed= (right now it forbids them which closes the door to any extensions...) Sent from my iPhone > On Aug 14, 2014, at 12:48 AM, Yoav Nir wrote: >=20 > Hi folks >=20 > Based on both the responses to this thread and previous threads about spec= ific enhancements, I think we can call this. >=20 > There were no posts saying that we absolutely should not make any changes t= o Basic and Digest. There were some people who said these changes were worth= while, and others who thought it didn=E2=80=99t add much. There were none in= the =E2=80=9Cthis makes things worse=E2=80=9D camp. >=20 > So I think we can call consensus on allowing changes (in general). >=20 > About the two proposals for changes: >=20 > 1. Add username hashing to Digest: there are more people who want this tha= n there are people who care enough to say that they don=E2=80=99t care. Ther= e is also some implementation and deployment experience. And it also serves a= privacy purpose by reducing the amount of personal information sent over th= e wire. So I think we can call this as accepted by the group. Since this mod= ification is already in the draft, there are no action items here for Rifaat= , David, and Sophie. >=20 > 2. Adding username suggestion by the server to Basic. So far I only see on= e person advocating it. Anyone else? >=20 > If people in the group think I=E2=80=99m misreading this, please let us kn= ow on-list soon. >=20 > Thanks >=20 > Yoav >=20 >> On Jul 24, 2014, at 6:24 PM, Yoav Nir wrote: >>=20 >> Hi >>=20 >> A question we raised at the HTTP-Auth meeting today was whether or not we= =E2=80=99d like to make any changes to Basic and Digest. >>=20 >> The charter requires us to add to things to these protocols: >> Adding internationalization support for user names and passwords >> Adding modern hash functions to Digest so that an implementation does not= depend on MD5. >>=20 >> There are a few additional extensions proposed. The Digest draft includes= optional username hashing, which (when used) will prevent the cleartext use= rname from being sent on the wire. This sounds (to me) to be a good idea pri= vacy-wise, but there is a claim that Basic and Digest are so horribly broken= anyway, that we don=E2=80=99t want to add security features to them, even i= f said security features seem like a good idea (hence the =E2=80=9Clipstick o= n a pig=E2=80=9D comment I made at the session [1]). >>=20 >> So the question I=E2=80=99m asking the group here is, do we want to tinke= r with Basic and Digest, potentially making them somewhat better, or do we w= ant to clamp down on all such discussion, and stick only to the mandates in t= he charter? >>=20 >> Yoav >>=20 >> [1] >> >=20 > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth --Boundary_(ID_EcH1UPVQwHVtDE/1tWH4xg) Content-type: text/html; charset=utf-8 Content-transfer-encoding: quoted-printable
If we don't add the username parameter= to Basic, then I'd just like to ask that the current draft be updated to al= low additional parameters to be passed (right now it forbids them which clos= es the door to any extensions...)

Sent from my iPhone

O= n Aug 14, 2014, at 12:48 AM, Yoav Nir <ynir.ietf@gmail.com> wrote:

Hi folks

Based on both the responses to this t= hread and previous threads about specific enhancements, I think we can call t= his.

There were no posts saying that we absolutely s= hould not make any changes to Basic and Digest. There were some people who s= aid these changes were worthwhile, and others who thought it didn=E2=80=99t a= dd much. There were none in the =E2=80=9Cthis makes things worse=E2=80=9D ca= mp.

So I think we can call consensus on allowing ch= anges (in general).

About the two proposals for cha= nges:

1. Add username hashing to Digest: there are m= ore people who want this than there are people who care enough to say that t= hey don=E2=80=99t care. There is also some implementation and deployment exp= erience. And it also serves a privacy purpose by reducing the amount of pers= onal information sent over the wire. So I think we can call this as accepted= by the group. Since this modification is already in the draft, there are no= action items here for Rifaat, David, and Sophie.

2= . Adding username suggestion by the server to Basic. So far I only see one p= erson advocating it. Anyone else?

If people in the g= roup think I=E2=80=99m misreading this, please let us know on-list soon.

Thanks

Yoav

On Jul 24, 2014, at 6:24 PM, Yoav Nir <ynir.ietf@gmail.com> wrote:

Hi
A question we raised at the HTTP-Auth meeting today was whe= ther or not we=E2=80=99d like to make any changes to Basic and Digest.
=

The charter requires us to add to things to these protoc= ols:
  1. Adding internationalization sup= port for user names and passwords
  2. Adding modern hash functions to Di= gest so that an implementation does not depend on MD5.

There are a few additional extensions proposed. The Digest dra= ft includes optional username hashing, which (when used) will prevent the cl= eartext username from being sent on the wire. This sounds (to me) to be a go= od idea privacy-wise, but there is a claim that Basic and Digest are so horr= ibly broken anyway, that we don=E2=80=99t want to add security features to t= hem, even if said security features seem like a good idea (hence the =E2=80=9C= lipstick on a pig=E2=80=9D comment I made at the session [1]).
So the question I=E2=80=99m asking the group here is, do we want= to tinker with Basic and Digest, potentially making them somewhat better, o= r do we want to clamp down on all such discussion, and stick only to the man= dates in the charter?

Yoav

[1]
<lipstick_pig_080910_mn1= .jpg>

__________________________________= _____________
http-auth mailing list
http-auth@ietf.org
https://www.ietf.org/m= ailman/listinfo/http-auth
= --Boundary_(ID_EcH1UPVQwHVtDE/1tWH4xg)-- From nobody Thu Aug 14 13:42:58 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E7641A8778; Thu, 14 Aug 2014 13:42:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6wdkXmHoYUTG; Thu, 14 Aug 2014 13:42:51 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D9E11A8760; Thu, 14 Aug 2014 13:42:51 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.6.2.p5 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140814204251.18052.29979.idtracker@ietfa.amsl.com> Date: Thu, 14 Aug 2014 13:42:51 -0700 Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/4-MD4gGqzQE3Ra1OfuVre4o7EwA Cc: http-auth@ietf.org Subject: [http-auth] I-D Action: draft-ietf-httpauth-hoba-04.txt X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Aug 2014 20:42:53 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF. Title : HTTP Origin-Bound Authentication (HOBA) Authors : Stephen Farrell Paul Hoffman Michael Thomas Filename : draft-ietf-httpauth-hoba-04.txt Pages : 23 Date : 2014-08-14 Abstract: HTTP Origin-Bound Authentication (HOBA) is a design for an HTTP authentication method with credentials that are not vulnerable to phishing attacks, and that does not require any server-side password database. The design can also be used in Javascript-based authentication embedded in HTML. HOBA is an alternative to HTTP authentication schemes that require passwords. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-httpauth-hoba/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-httpauth-hoba-04 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-hoba-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Aug 14 16:19:10 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF2081A8955 for ; Thu, 14 Aug 2014 16:19:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.5 X-Spam-Level: X-Spam-Status: No, score=-0.5 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hEGAstRHe-ei for ; Thu, 14 Aug 2014 16:19:08 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.19]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B9E51A88FC for ; Thu, 14 Aug 2014 16:19:08 -0700 (PDT) Received: from [192.168.208.77] ([209.117.47.248]) by mail.gmx.com (mrgmx001) with ESMTPSA (Nemesis) id 0LdYdG-1Wan361WD4-00ijWP; Fri, 15 Aug 2014 01:19:02 +0200 Message-ID: <53ED43E4.3060607@gmx.de> Date: Fri, 15 Aug 2014 01:19:00 +0200 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.0 MIME-Version: 1.0 To: Mike Sweet , Yoav Nir References: <3DD81803-39CF-42D7-AB71-CC3813E7EDAB@gmail.com> <82EA5C58-0A89-4077-BBF4-68E9367E3CE6@gmail.com> <7D09994D-5C35-4FF4-9F4F-5A8E1D11D9E7@apple.com> In-Reply-To: <7D09994D-5C35-4FF4-9F4F-5A8E1D11D9E7@apple.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K0:qwJ3MH4mrQWhI7fcWwWszwWy/DWcNzrg77dgV1BKuh2qi7xeSE6 eCDcZT/58QvzAdxZWQKpi25JmtdD1LKU5zu++mMaHd/qw1yqQAV1PmzRl1vb1bbYdf4j8df hwwF/oq/5Ex19Ji29CNTfoh0dGGelf3X/XRTa4JLMKUVsEFGz/5W/q/PbJ6kX8fmDVzpjUH Abuz/1mlo30N/5ciEikYQ== X-UI-Out-Filterresults: notjunk:1; Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/5zjEO6vD0uZz33PCc-4_jbL503s Cc: IETF HTTP Auth Subject: Re: [http-auth] Modifications to Basic & Digest X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Aug 2014 23:19:10 -0000 On 2014-08-14 12:37, Mike Sweet wrote: > If we don't add the username parameter to Basic, then I'd just like to > ask that the current draft be updated to allow additional parameters to > be passed (right now it forbids them which closes the door to any > extensions...) It doesn't forbid them. It says they are to be ignored, and that you need to revise the spec to add new. Best regards, Julian From nobody Thu Aug 14 22:27:30 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDE231A8A17 for ; Thu, 14 Aug 2014 22:27:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.867 X-Spam-Level: X-Spam-Status: No, score=-4.867 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.668] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fchX7g3Y42Qe for ; Thu, 14 Aug 2014 22:27:25 -0700 (PDT) Received: from g4t3425.houston.hp.com (g4t3425.houston.hp.com [15.201.208.53]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B82DE1A8A15 for ; Thu, 14 Aug 2014 22:27:25 -0700 (PDT) Received: from G9W0364.americas.hpqcorp.net (g9w0364.houston.hp.com [16.216.193.45]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by g4t3425.houston.hp.com (Postfix) with ESMTPS id EF0D017F for ; Fri, 15 Aug 2014 05:27:24 +0000 (UTC) Received: from G4W6305.americas.hpqcorp.net (16.210.26.230) by G9W0364.americas.hpqcorp.net (16.216.193.45) with Microsoft SMTP Server (TLS) id 14.3.169.1; Fri, 15 Aug 2014 05:24:42 +0000 Received: from G4W3298.americas.hpqcorp.net ([169.254.4.87]) by G4W6305.americas.hpqcorp.net ([16.210.26.230]) with mapi id 14.03.0169.001; Fri, 15 Aug 2014 05:24:42 +0000 From: "Kennedy, Smith (Wireless Architect)" To: Yoav Nir Thread-Topic: [http-auth] Modifications to Basic & Digest Thread-Index: AQHPp1OloH8s61MMT0muwQYB1pNtt5vPp0OAgAGcggA= Date: Fri, 15 Aug 2014 05:24:41 +0000 Message-ID: <81DED1F2-4FC0-4AF1-A780-98060D663A4C@hp.com> References: <3DD81803-39CF-42D7-AB71-CC3813E7EDAB@gmail.com> <82EA5C58-0A89-4077-BBF4-68E9367E3CE6@gmail.com> In-Reply-To: <82EA5C58-0A89-4077-BBF4-68E9367E3CE6@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [15.201.58.14] Content-Type: multipart/signed; boundary="Apple-Mail=_A6F26DE9-A867-405B-8271-0B7462B1394C"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/IBungUM32vXeJ7x3myFT4u6ChAc Cc: IETF HTTP Auth Subject: Re: [http-auth] Modifications to Basic & Digest X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Aug 2014 05:27:27 -0000 --Apple-Mail=_A6F26DE9-A867-405B-8271-0B7462B1394C Content-Type: multipart/alternative; boundary="Apple-Mail=_7A94C65A-A1DA-407F-B31E-184F39CA5717" --Apple-Mail=_7A94C65A-A1DA-407F-B31E-184F39CA5717 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 +1 for #2. Smith /** Smith Kennedy ATB Wireless Architect - PPS Hewlett-Packard Co. */ On 2014-08-13, at 10:48 PM, Yoav Nir wrote: > Hi folks >=20 > Based on both the responses to this thread and previous threads about = specific enhancements, I think we can call this. >=20 > There were no posts saying that we absolutely should not make any = changes to Basic and Digest. There were some people who said these = changes were worthwhile, and others who thought it didn=92t add much. = There were none in the =93this makes things worse=94 camp. >=20 > So I think we can call consensus on allowing changes (in general). >=20 > About the two proposals for changes: >=20 > 1. Add username hashing to Digest: there are more people who want this = than there are people who care enough to say that they don=92t care. = There is also some implementation and deployment experience. And it also = serves a privacy purpose by reducing the amount of personal information = sent over the wire. So I think we can call this as accepted by the = group. Since this modification is already in the draft, there are no = action items here for Rifaat, David, and Sophie. >=20 > 2. Adding username suggestion by the server to Basic. So far I only = see one person advocating it. Anyone else? >=20 > If people in the group think I=92m misreading this, please let us know = on-list soon. >=20 > Thanks >=20 > Yoav >=20 > On Jul 24, 2014, at 6:24 PM, Yoav Nir wrote: >=20 >> Hi >>=20 >> A question we raised at the HTTP-Auth meeting today was whether or = not we=92d like to make any changes to Basic and Digest. >>=20 >> The charter requires us to add to things to these protocols: >> Adding internationalization support for user names and passwords >> Adding modern hash functions to Digest so that an implementation does = not depend on MD5. >>=20 >> There are a few additional extensions proposed. The Digest draft = includes optional username hashing, which (when used) will prevent the = cleartext username from being sent on the wire. This sounds (to me) to = be a good idea privacy-wise, but there is a claim that Basic and Digest = are so horribly broken anyway, that we don=92t want to add security = features to them, even if said security features seem like a good idea = (hence the =93lipstick on a pig=94 comment I made at the session [1]). >>=20 >> So the question I=92m asking the group here is, do we want to tinker = with Basic and Digest, potentially making them somewhat better, or do we = want to clamp down on all such discussion, and stick only to the = mandates in the charter? >>=20 >> Yoav >>=20 >> [1] >> >=20 > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth --Apple-Mail=_7A94C65A-A1DA-407F-B31E-184F39CA5717 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 +1 for = #2.

ynir.ietf@gmail.com> = wrote:

Hi = folks

Based on both the responses to this thread and = previous threads about specific enhancements, I think we can call = this.

There were no posts saying that we = absolutely should not make any changes to Basic and Digest. There were = some people who said these changes were worthwhile, and others who = thought it didn=92t add much. There were none in the =93this makes = things worse=94 camp.

So I think we can call = consensus on allowing changes (in = general).

About the two proposals for = changes:

1. Add username hashing to Digest: = there are more people who want this than there are people who care = enough to say that they don=92t care. There is also some implementation = and deployment experience. And it also serves a privacy purpose by = reducing the amount of personal information sent over the wire. So I = think we can call this as accepted by the group. Since this modification = is already in the draft, there are no action items here for Rifaat, = David, and Sophie.

2. Adding username = suggestion by the server to Basic. So far I only see one person = advocating it. Anyone else?

If people in the = group think I=92m misreading this, please let us know on-list = soon.

Thanks

Yoav
<= div>
On Jul 24, 2014, at 6:24 PM, Yoav Nir <ynir.ietf@gmail.com> = wrote:

Hi

A = question we raised at the HTTP-Auth meeting today was whether or not = we=92d like to make any changes to Basic and = Digest.

The charter requires us to add to = things to these protocols:
  1. Adding = internationalization support for user names and passwords
  2. Adding = modern hash functions to Digest so that an implementation does not = depend on MD5.

There are a few = additional extensions proposed. The Digest draft includes optional = username hashing, which (when used) will prevent the cleartext username = from being sent on the wire. This sounds (to me) to be a good idea = privacy-wise, but there is a claim that Basic and Digest are so horribly = broken anyway, that we don=92t want to add security features to them, = even if said security features seem like a good idea (hence the = =93lipstick on a pig=94 comment I made at the session = [1]).

So the question I=92m asking the group = here is, do we want to tinker with Basic and Digest, potentially making = them somewhat better, or do we want to clamp down on all such = discussion, and stick only to the mandates in the = charter?

Yoav

[1]
<= div>
<lipstick_pig_080910_mn1.jpg>

_________________________________________= ______
http-auth mailing list
http-auth@ietf.org
https://www.i= etf.org/mailman/listinfo/http-auth

= = --Apple-Mail=_7A94C65A-A1DA-407F-B31E-184F39CA5717-- --Apple-Mail=_A6F26DE9-A867-405B-8271-0B7462B1394C Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIOQDCCBmEw ggVJoAMCAQICEFHz5uyygZHVFZ4pmbCHOnswDQYJKoZIhvcNAQEFBQAwgcoxCzAJBgNVBAYTAlVT MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29y azE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ug b25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0 aW9uIEF1dGhvcml0eSAtIEczMB4XDTA5MDkwMjAwMDAwMFoXDTE0MDkwMTIzNTk1OVowgfcxCzAJ BgNVBAYTAlVTMSAwHgYDVQQKExdIZXdsZXR0LVBhY2thcmQgQ29tcGFueTEfMB0GA1UECxMWVmVy aVNpZ24gVHJ1c3QgTmV0d29yazE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3 LnZlcmlzaWduLmNvbS9ycGEgKGMpMDkxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5k aXZpZHVhbCBTdWJzY3JpYmVyIENBMTEwLwYDVQQDEyhDb2xsYWJvcmF0aW9uIENlcnRpZmljYXRp b24gQXV0aG9yaXR5IEcyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp2FraNquqoVk DEvLUMsw6HMhjon+yi1v/kajA27jIrdyhRMj4g+PBveBTHrtA7w97Rx1UKPP6CvOaAE5xUtoW9aj YZtO5kdiUFyzWHsbUgSjKy+yNO4QoHeEzaQi/JWUOYev/AV5YYJoEDIysosEELS1/M64iE2Utzr+ LxiWhdaqSRE4jigbm4Dy4ayLzqAv5f7oILrJNZ6ShqLiGGCpP+7relTyRgFXmEX/SKN/a39JwZoK SNUdIkYyr7wmNI9+zylheDJghuk+kZDAD3NXv4EGVMUfOg5UEdhAJ0Lw40D4pqKa2ej1H0UipK1E EdRTm94RzfE8z8vDP8+dcgOqCwIDAQABo4ICEjCCAg4wEgYDVR0TAQH/BAgwBgEB/wIBADBwBgNV HSAEaTBnMGUGC2CGSAGG+EUBBxcCMFYwKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWdu LmNvbS9jcHMwKgYIKwYBBQUHAgIwHhocaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYTA0BgNV HR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2EyLWczLmNybDAOBgNVHQ8B Af8EBAMCAQYwLgYDVR0RBCcwJaQjMCExHzAdBgNVBAMTFlByaXZhdGVMYWJlbDQtMjA0OC0xNDIw HQYDVR0OBBYEFCJ906SrV6xWf6l/QUQalbxb+KvuMIHwBgNVHSMEgegwgeWhgdCkgc0wgcoxCzAJ BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1 c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9y aXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczghBhcMtJjF+YRSnnsKbZUFt6MA0GCSqGSIb3DQEB BQUAA4IBAQAvUbxneMj/3SU5WlUKapv9ZGIeeNSf6/t6gKUUsCT2A1KQMlZmK7/gn4ndrXWdch7U afl6WkPlBcunYRGvJ6YkJCP4uV86Lwv68mK6REwJFMiKHy/qFnRaoI+pLfaIlMQ9l7Q2DRnNLSyC Bl9b02PaGzX+XQQxGhLiE89Z1E+ajicWG1zRzBUbPx46ptQUjfjYPNyP4cLWT5rJ7olc9/mRyfIO 4nGU8lRjGcuKwxZhOP+TftJgd/fRYf68Kf2Bkue4cdrI2UUgYD02GBL/S8E8FBsOrAoJ5N6cEYac wT2BZgHzYrxTC5ZyxzY9TWtGldxEH/moJ5OLtF+KauJWhaACMIIH1zCCBr+gAwIBAgIQPOXfUUI6 ovNsyP+l8ouxZTANBgkqhkiG9w0BAQUFADCB9zELMAkGA1UEBhMCVVMxIDAeBgNVBAoTF0hld2xl dHQtUGFja2FyZCBDb21wYW55MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYD VQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTE1 MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0ExMTAv BgNVBAMTKENvbGxhYm9yYXRpb24gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIwHhcNMTIxMTI2 MDAwMDAwWhcNMTQxMTI2MjM1OTU5WjCBmDEgMB4GA1UEChQXSGV3bGV0dC1QYWNrYXJkIENvbXBh bnkxJjAkBgNVBAsUHUVtcGxveW1lbnQgU3RhdHVzIC0gRW1wbG95ZWVzMQ8wDQYDVQQLEwZTL01J TUUxFjAUBgNVBAMTDVNtaXRoIEtlbm5lZHkxIzAhBgkqhkiG9w0BCQEWFHNtaXRoLmtlbm5lZHlA aHAuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuageabAIyTS0JIjXDq1iml4l fdgg3AULnBQiEK3wdxFb8Cyz2fsHE/UykFRJyZilpA6MUj6fom56o02WYfKxb3AUbwWJLGjAB/YL pw36SatXUw7OmuumNllMH3v2WpEP9QblEKjgE3LdpNO2owWTsmSsvVAfzItrkg6BR3fo3tsrf6dL PpbdfeOjkbwRrHnEm/AKKg5DPOZyVEqmgNEoVPflsem1QIPRVHshjvj0iTv4DhEGnnbDvMpiuzo3 n0fLQ/HETM6xAiZQLv76aFEm2DkB1fvnAApvrrm/dvhFmMkExCGNh1TwCXd7+KrfradSomasVs2G kz0tJqmOlsKbsQIDAQABo4IDujCCA7YwHwYDVR0RBBgwFoEUc21pdGgua2VubmVkeUBocC5jb20w DAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwWQYDVR0fBFIwUDBOoEygSoZIaHR0cDovL29u c2l0ZWNybC52ZXJpc2lnbi5jb20vSGV3bGV0dFBhY2thcmRDb21wYW55U01JTUVHMi9MYXRlc3RD UkwuY3JsMB8GA1UdIwQYMBaAFCJ906SrV6xWf6l/QUQalbxb+KvuMB0GA1UdDgQWBBTa6BzKTU+H dS93ruL/3n7ZMTXvgjCCATIGCCsGAQUFBwEBBIIBJDCCASAwJwYIKwYBBQUHMAGGG2h0dHA6Ly9o cC1vY3NwLnZlcmlzaWduLmNvbTCB9AYIKwYBBQUHMAKkgecwgeQxMTAvBgNVBAMTKENvbGxhYm9y YXRpb24gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzIxMDAuBgNVBAsTJ0NsYXNzIDIgT25TaXRl IEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTE6MDgGA1UECxMxVGVybXMgb2YgdXNlIGF0IGh0dHBz Oi8vd3d3LnZlcmlzaWduLmNvbS9ycGEoYykwOTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0 d29yazEgMB4GA1UEChMXSGV3bGV0dC1QYWNrYXJkIENvbXBhbnkwggE9BgNVHSAEggE0MIIBMDCC ASwGC2CGSAGG+EUBBxcCMIIBGzAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29t L3JwYTCB7gYIKwYBBQUHAgIwgeEwHhYXSGV3bGV0dC1QYWNrYXJkIENvbXBhbnkwAwIBAhqBvkF1 dGhvcml0eSB0byBiaW5kIEhQIGRvZXMgbm90IGNvcnJlc3BvbmQgd2l0aCB1c2Ugb3IgcG9zc2Vz c2lvbiBvZiB0aGlzIGNlcnRpZmljYXRlLiBJc3N1ZWQgdG8gZmFjaWxpdGF0ZSBjb21tdW5pY2F0 aW9uIHdpdGggSFAuIFZlcmlTaWduJ3MgQ1BTIGluY29ycC4gQnkgcmVmZXJlbmNlIGxpYWIuIGx0 ZC4gKGMpOTcgVmVyaVNpZ24wFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwQwSwYJKoZIhvcNAQkPBD4w PDAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcNAwICAgBAMA4GCCqGSIb3DQMEAgIAgDAKBggqhkiG 9w0DBzANBgkqhkiG9w0BAQUFAAOCAQEAibIOTCm5SdtOxug7ClAA9DgzWNtmR9ZL+YujqiPpc5YC mr0hDWOTCjAJbDAIDcXfAJspAamEnwd0tpUZj0DOc4RCiLEsfH2uchNqr2UV5qAJmKq0Wrr+Lfd6 1ZFvp1encVlif2KSFi/vgTCKX+57rVWpb284BmrnVa30nOcuZVKQk3XUDignE0vz+OIrza1JcyRQ d7TtVtlRQX63rT0P3v2u9UrryzDo/5wN77jqDLqgz0se0g23wVyWuj/jmFB7QV1bUDV2bLHh3Ipb 9JtEri7DlzSde9pmfRauWerZHGb/AI0qcbEC2nSKvv/u5tHoaMHfG58GM0unnsmBu4UiDjGCBN4w ggTaAgEBMIIBDDCB9zELMAkGA1UEBhMCVVMxIDAeBgNVBAoTF0hld2xldHQtUGFja2FyZCBDb21w YW55MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1 c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTE1MDMGA1UECxMsQ2xhc3Mg MiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0ExMTAvBgNVBAMTKENvbGxhYm9y YXRpb24gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzICEDzl31FCOqLzbMj/pfKLsWUwCQYFKw4D AhoFAKCCAqUwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTQwODE1 MDUyNDQyWjAjBgkqhkiG9w0BCQQxFgQU3lgneBRbXfoyQHWrj6T/2dk56WswggEfBgkrBgEEAYI3 EAQxggEQMIIBDDCB9zELMAkGA1UEBhMCVVMxIDAeBgNVBAoTF0hld2xldHQtUGFja2FyZCBDb21w YW55MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1 c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTE1MDMGA1UECxMsQ2xhc3Mg MiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0ExMTAvBgNVBAMTKENvbGxhYm9y YXRpb24gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRzICEDzl31FCOqLzbMj/pfKLsWUwggEhBgsq hkiG9w0BCRACCzGCARCgggEMMIH3MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXSGV3bGV0dC1QYWNr YXJkIENvbXBhbnkxHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRl cm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChjKTA5MTUwMwYDVQQL EyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTExMC8GA1UEAxMo Q29sbGFib3JhdGlvbiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBHMgIQPOXfUUI6ovNsyP+l8oux ZTANBgkqhkiG9w0BAQEFAASCAQBoJEymq9QEgFdieRWE8NNgq2ccWeRxwpFRr7EE6z5kc/J/bBep dFLFhPF44C/kydY4/9rf3prxlqlDK3xERAc8pXKYUcazOcuBBe3TVUBOdvY/KKZmYck+FRhul3FE 0anlwHVDw5qNnD2ASveiFqMMFlvODHHyZDP9pRcHVcwoSTKMCWdp/myHqXNxyYSOqU/5JSjZoAHA Ry2/c+C/4DF+PgVEMVysjY98dB+Fdmtv+kNASVwJKqiwJwxUijkv4M7aBNq+n3LfzyCQ36iPCeJx MLnRzmrYW4TMGsK+whG6bbp0qKYR7gIxYBxj6sfhdrm0Mfcwsb8IxbDVVGcjkkLBAAAAAAAA --Apple-Mail=_A6F26DE9-A867-405B-8271-0B7462B1394C-- From nobody Fri Aug 15 11:35:34 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 220401A00FE for ; Fri, 15 Aug 2014 11:35:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.9 X-Spam-Level: X-Spam-Status: No, score=-0.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c99O_BQ0kiD2 for ; Fri, 15 Aug 2014 11:35:29 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.22]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 121D81A00CD for ; Fri, 15 Aug 2014 11:35:29 -0700 (PDT) Received: from [192.168.1.136] ([213.167.158.76]) by mail.gmx.com (mrgmx102) with ESMTPSA (Nemesis) id 0MRB8F-1WoMaZ3FYF-00UeP5; Fri, 15 Aug 2014 20:35:25 +0200 Message-ID: <53EE52EC.3060003@gmx.de> Date: Fri, 15 Aug 2014 20:35:24 +0200 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.0 MIME-Version: 1.0 To: "Kennedy, Smith (Wireless Architect)" , Yoav Nir References: <3DD81803-39CF-42D7-AB71-CC3813E7EDAB@gmail.com> <82EA5C58-0A89-4077-BBF4-68E9367E3CE6@gmail.com> <81DED1F2-4FC0-4AF1-A780-98060D663A4C@hp.com> In-Reply-To: <81DED1F2-4FC0-4AF1-A780-98060D663A4C@hp.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-Provags-ID: V03:K0:podFv5zMQDE+WQMqw32nstYB0uUPzOVyWG4fFMUSm1fJyqFN3HH L81v+jswTv1NL/q+4hlxF2S1zlLMYJSmFJBL8m71fJf75SBN1dh/IWkiOq44Cd4q2c3lsWJ om/y9IRu7cz0SMWc+vIsvDNfIAGGKx6LMHKAB9cmw3CluaQ4Tm6Wk3MPvtdQZLxq7lAwYgl nQSQhUQ2EqwSSjvwNHl1Q== X-UI-Out-Filterresults: notjunk:1; Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/A9UkVmVVPnvsxzJep4aQ9se2d7U Cc: IETF HTTP Auth Subject: Re: [http-auth] Modifications to Basic & Digest X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Aug 2014 18:35:31 -0000 As author of the Basic spec, I'm *very* -1 on adding anything new that is not essential. We can discuss an IANA registry for parameters, but adding something experimental at this point doesn't make any sense to me. Best regards, Julian On 2014-08-15 07:24, Kennedy, Smith (Wireless Architect) wrote: > +1 for #2. > > Smith > > /** > Smith Kennedy > ATB Wireless Architect - PPS > Hewlett-Packard Co. > */ > > > > > On 2014-08-13, at 10:48 PM, Yoav Nir > wrote: > >> Hi folks >> >> Based on both the responses to this thread and previous threads about >> specific enhancements, I think we can call this. >> >> There were no posts saying that we absolutely should not make any >> changes to Basic and Digest. There were some people who said these >> changes were worthwhile, and others who thought it didn’t add much. >> There were none in the “this makes things worse” camp. >> >> So I think we can call consensus on allowing changes (in general). >> >> About the two proposals for changes: >> >> 1. Add username hashing to Digest: there are more people who want this >> than there are people who care enough to say that they don’t care. >> There is also some implementation and deployment experience. And it >> also serves a privacy purpose by reducing the amount of personal >> information sent over the wire. So I think we can call this as >> accepted by the group. Since this modification is already in the >> draft, there are no action items here for Rifaat, David, and Sophie. >> >> 2. Adding username suggestion by the server to Basic. So far I only >> see one person advocating it. Anyone else? >> >> If people in the group think I’m misreading this, please let us know >> on-list soon. >> >> Thanks >> >> Yoav >> >> On Jul 24, 2014, at 6:24 PM, Yoav Nir > > wrote: >> >>> Hi >>> >>> A question we raised at the HTTP-Auth meeting today was whether or >>> not we’d like to make any changes to Basic and Digest. >>> >>> The charter requires us to add to things to these protocols: >>> >>> 1. Adding internationalization support for user names and passwords >>> 2. Adding modern hash functions to Digest so that an implementation >>> does not depend on MD5. >>> >>> >>> There are a few additional extensions proposed. The Digest draft >>> includes optional username hashing, which (when used) will prevent >>> the cleartext username from being sent on the wire. This sounds (to >>> me) to be a good idea privacy-wise, but there is a claim that Basic >>> and Digest are so horribly broken anyway, that we don’t want to add >>> security features to them, even if said security features seem like a >>> good idea (hence the “lipstick on a pig” comment I made at the >>> session [1]). >>> >>> So the question I’m asking the group here is, do we want to tinker >>> with Basic and Digest, potentially making them somewhat better, or do >>> we want to clamp down on all such discussion, and stick only to the >>> mandates in the charter? >>> >>> Yoav >>> >>> [1] >>> >> >> _______________________________________________ >> http-auth mailing list >> http-auth@ietf.org >> https://www.ietf.org/mailman/listinfo/http-auth > > > > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth > From nobody Fri Aug 15 11:59:55 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 287661A02A3 for ; Fri, 15 Aug 2014 11:59:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.969 X-Spam-Level: X-Spam-Status: No, score=-4.969 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.668, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id APRFdqfqvapc for ; Fri, 15 Aug 2014 11:59:52 -0700 (PDT) Received: from mail-in7.apple.com (mail-out7.apple.com [17.151.62.29]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E0251A028B for ; Fri, 15 Aug 2014 11:59:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=apple.com; s=mailout2048s; c=relaxed/simple; q=dns/txt; i=@apple.com; t=1408129191; x=2272042791; h=From:Sender:Reply-To:Subject:Date:Message-id:To:Cc:MIME-version:Content-type: Content-transfer-encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-reply-to:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=puR91x1jNMFQJidK46H9qJzsEj1uvVbkbmhugEp7fsI=; b=fX81xdzRwWROAQZ34afVdLne/LxcfbEv6GRGH6iNRY16lKsyEqZFr0ejW9ONLE5U c64c8D1VvVCOWPRT+QDhjIyFeOXZ/unBinHF/a0gyeusqPPwvVUl2BfXdf0imY/7 TNo4eMDxdOxXJD7Bi4658mMBFsBh9nDZDpBsojHvLcuz2VTSzEWz2wFc8aotOAaf BWBBTIliyiUJY6ku+AZmcyrdOMtmoumQAW6TRzwCSmgZNSC+6gI+Y16yM8H6gYLO ypqvN0bMmOwATYqhgRpyUwrtjO6RivTag8XDWDwiO2iaMWTNehXqkcu2DGMtjq5O C2dV1+fc3y3E4LCSeun2AA==; Received: from mail-out.apple.com (bramley.apple.com [17.151.62.49]) (using TLS with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by mail-in7.apple.com (Apple Secure Mail Relay) with SMTP id 76.46.13396.6A85EE35; Fri, 15 Aug 2014 11:59:51 -0700 (PDT) MIME-version: 1.0 Content-type: text/plain; charset=windows-1252 Received: from relay2.apple.com ([17.128.113.67]) by local.mail-out.apple.com (Oracle Communications Messaging Server 7.0.5.30.0 64bit (built Oct 22 2013)) with ESMTP id <0NAD00HGT3DW65U0@local.mail-out.apple.com> for http-auth@ietf.org; Fri, 15 Aug 2014 11:59:49 -0700 (PDT) X-AuditID: 11973e16-f79bb6d000003454-8e-53ee58a5da27 Received: from cardamom.apple.com (cardamom.apple.com [17.128.115.94]) (using TLS with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by relay2.apple.com (Apple SCV relay) with SMTP id 62.29.19003.4A85EE35; Fri, 15 Aug 2014 11:59:48 -0700 (PDT) Received: from [17.153.60.11] by cardamom.apple.com (Oracle Communications Messaging Server 7.0.5.30.0 64bit (built Oct 22 2013)) with ESMTPSA id <0NAD009JJ3FNA480@cardamom.apple.com> for http-auth@ietf.org; Fri, 15 Aug 2014 11:59:49 -0700 (PDT) From: Michael Sweet In-reply-to: <53EE52EC.3060003@gmx.de> Date: Fri, 15 Aug 2014 14:59:47 -0400 Content-transfer-encoding: quoted-printable Message-id: <6EB355AE-2158-4405-BA3C-7F8CB0599B14@apple.com> References: <3DD81803-39CF-42D7-AB71-CC3813E7EDAB@gmail.com> <82EA5C58-0A89-4077-BBF4-68E9367E3CE6@gmail.com> <81DED1F2-4FC0-4AF1-A780-98060D663A4C@hp.com> <53EE52EC.3060003@gmx.de> To: Julian Reschke X-Mailer: Apple Mail (2.1878.6) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrLLMWRmVeSWpSXmKPExsUiON3OUHd5xLtgg7/n+C0+7J/D5MDosWTJ T6YAxigum5TUnMyy1CJ9uwSujGXnZjAV/FOq6Jy6gq2Bcb1MFyMnh4SAicSle2uZIGwxiQv3 1rN1MXJxCAnMZJJYcmIRC0iCV0BQ4sfke0A2BwezgJ7E/YtaIGGwmh0TxGHmdPadZoeIT2SS mDNXBGLOb0aJ9sXn2UF6hQUsJCY1eILUsAmoSfye1McKYnMC2dc3LAa7gUVAVWLK1e3MIL3M Au2MEl8OTwErYhbQlnjy7gIrxD02EpdfH2aHWLCTUeLot/uMIAkRAS2J2/f2MkJcJC/x4cNx sCIJgc+sElt7m1knMIrMQvLQLISHZiHZsYCReRWjUG5iZo5uZp65XmJBQU6qXnJ+7iZGSHiL 7WB8uMrqEKMAB6MSD6+A+LtgIdbEsuLK3EOM0hwsSuK8Co5vg4UE0hNLUrNTUwtSi+KLSnNS iw8xMnFwSjUw2jscMNlY91G8MohLtsFTULTiqdamUOXHYfMV3H7d26w884yME9Mex8Dw+X2X U8XyJ6oKfT9s5Vr2wuXMvSPrVXazaZ03mHdX8n7G4yWfPl2dUma6/e31go4fC/p2MEx8bbPO I/Qd7+I216SFq2Ytn3vUnvO4Bc+tYyYntHYqvLx5wu0VW77pIyWW4oxEQy3mouJEAGInCAFQ AgAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrKLMWRmVeSWpSXmKPExsUi2FAcp7sk4l2wwe+PYhYf9s9hcmD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxrJzM5gK/ilVdE5dwdbAuF6mi5GTQ0LARKKz7zQ7hC0mceHe erYuRi4OIYGJTBKLG34zQTi/GSXaF58HquLgEBawkJjU4AnSwCtgIPHq52NmkDCzgJ7E/Yta IGE2ATWJ35P6WEFsTiD7+obFTCA2i4CqxJSr25lBRjILtDNKfDk8BayIWUBb4sm7C6wQM20k Lr8+zA6xdyejxNFv9xlBEiICWhK37+1lhLhUXuLDh+PsExgFZiG5YxbCHbOQjF3AyLyKUaAo NSex0kgvsaAgJ1UvOT93EyM48AqddzAeW2Z1iFGAg1GJh1dA/F2wEGtiWXFl7iFGCQ5mJRHe VW5AId6UxMqq1KL8+KLSnNTiQ4zSHCxK4ryRHkApgfTEktTs1NSC1CKYLBMHp1QDYxjjyWyP E463Xiz+XPJ6reySm4wh3gVba7XWOu7uu3hV+IGVoIkK09SC1WZG3AsNy+z++nxbFJtbk8Xz 6U9Ux7f+c8+WNzPFL5m4u/DX2T9zmepObLrLttePN3fr0U8zGQW35HzVrNqzdN81oTtzbbvM w7tMMy9OkKiWUX1RWnb4QtLaTdf6+pVYijMSDbWYi4oTAaWYFzo4AgAA Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/UpOyEzxtNDvOziPSKvEilgiiSeM Cc: IETF HTTP Auth Subject: Re: [http-auth] Modifications to Basic & Digest X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Aug 2014 18:59:54 -0000 Julian, An IANA registry for parameters would work. Needing a spec/RFC for it = can be problematic (since publishing through the IETF is not a fast = process and far from a sure thing, even for an informational document), = but if we can register a parameter then at least people know about it. On Aug 15, 2014, at 2:35 PM, Julian Reschke = wrote: > As author of the Basic spec, I'm *very* -1 on adding anything new that = is not essential. >=20 > We can discuss an IANA registry for parameters, but adding something = experimental at this point doesn't make any sense to me. >=20 > Best regards, Julian >=20 >=20 > On 2014-08-15 07:24, Kennedy, Smith (Wireless Architect) wrote: >> +1 for #2. >>=20 >> Smith >>=20 >> /** >> Smith Kennedy >> ATB Wireless Architect - PPS >> Hewlett-Packard Co. >> */ >>=20 >>=20 >>=20 >>=20 >> On 2014-08-13, at 10:48 PM, Yoav Nir > > wrote: >>=20 >>> Hi folks >>>=20 >>> Based on both the responses to this thread and previous threads = about >>> specific enhancements, I think we can call this. >>>=20 >>> There were no posts saying that we absolutely should not make any >>> changes to Basic and Digest. There were some people who said these >>> changes were worthwhile, and others who thought it didn=92t add = much. >>> There were none in the =93this makes things worse=94 camp. >>>=20 >>> So I think we can call consensus on allowing changes (in general). >>>=20 >>> About the two proposals for changes: >>>=20 >>> 1. Add username hashing to Digest: there are more people who want = this >>> than there are people who care enough to say that they don=92t care. >>> There is also some implementation and deployment experience. And it >>> also serves a privacy purpose by reducing the amount of personal >>> information sent over the wire. So I think we can call this as >>> accepted by the group. Since this modification is already in the >>> draft, there are no action items here for Rifaat, David, and Sophie. >>>=20 >>> 2. Adding username suggestion by the server to Basic. So far I only >>> see one person advocating it. Anyone else? >>>=20 >>> If people in the group think I=92m misreading this, please let us = know >>> on-list soon. >>>=20 >>> Thanks >>>=20 >>> Yoav >>>=20 >>> On Jul 24, 2014, at 6:24 PM, Yoav Nir >> > wrote: >>>=20 >>>> Hi >>>>=20 >>>> A question we raised at the HTTP-Auth meeting today was whether or >>>> not we=92d like to make any changes to Basic and Digest. >>>>=20 >>>> The charter requires us to add to things to these protocols: >>>>=20 >>>> 1. Adding internationalization support for user names and passwords >>>> 2. Adding modern hash functions to Digest so that an implementation >>>> does not depend on MD5. >>>>=20 >>>>=20 >>>> There are a few additional extensions proposed. The Digest draft >>>> includes optional username hashing, which (when used) will prevent >>>> the cleartext username from being sent on the wire. This sounds (to >>>> me) to be a good idea privacy-wise, but there is a claim that Basic >>>> and Digest are so horribly broken anyway, that we don=92t want to = add >>>> security features to them, even if said security features seem like = a >>>> good idea (hence the =93lipstick on a pig=94 comment I made at the >>>> session [1]). >>>>=20 >>>> So the question I=92m asking the group here is, do we want to = tinker >>>> with Basic and Digest, potentially making them somewhat better, or = do >>>> we want to clamp down on all such discussion, and stick only to the >>>> mandates in the charter? >>>>=20 >>>> Yoav >>>>=20 >>>> [1] >>>> >>>=20 >>> _______________________________________________ >>> http-auth mailing list >>> http-auth@ietf.org >>> https://www.ietf.org/mailman/listinfo/http-auth >>=20 >>=20 >>=20 >> _______________________________________________ >> http-auth mailing list >> http-auth@ietf.org >> https://www.ietf.org/mailman/listinfo/http-auth >>=20 >=20 > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth _________________________________________________________ Michael Sweet, Senior Printing System Engineer, PWG Chair From nobody Fri Aug 15 12:14:49 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C908F1A0303 for ; Fri, 15 Aug 2014 12:14:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.23 X-Spam-Level: X-Spam-Status: No, score=-1.23 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_SORBS_WEB=0.77, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IXhjPGUD1dX7 for ; Fri, 15 Aug 2014 12:14:45 -0700 (PDT) Received: from mail-wi0-x232.google.com (mail-wi0-x232.google.com [IPv6:2a00:1450:400c:c05::232]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D36E01A0309 for ; Fri, 15 Aug 2014 12:14:44 -0700 (PDT) Received: by mail-wi0-f178.google.com with SMTP id hi2so1219765wib.5 for ; Fri, 15 Aug 2014 12:14:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=2LP2SNyvjoNWFencRMp8UA49yv1Bwev/vR4xMD1QBus=; b=BxGb/UR780x9R/W4v3vQp1Q19WD903oUvRqSwxKge/K5c3GbeXLe2y6uWDsEZOl1eC WBgNQcliZbmgBgg7xC21QJe7AaX0qw0C0ocRcrUjy6QRdT+tmEkv0dmnubh7ncVGhbgF tH4juouz1tNlS8oCbGdavJujCh0ZWc2Q1Ojlb/v7+aC0meDcNKyBwL55Hm91J8UUi5UV t3S6kDEabOQob+jf9PrQ4lN+PX1YsFznqqw73HTFIabxGZ0qk4Exnf6DKwUX8tbk5g4S gZablbfs6Y35hsbkeXauj2aJQuBEIjnTmWYuFeSTHK+pcXjzgkQ8S4Q3NIfgWvXYB2r+ yfiw== X-Received: by 10.195.12.103 with SMTP id ep7mr4910689wjd.121.1408130083522; Fri, 15 Aug 2014 12:14:43 -0700 (PDT) Received: from [172.17.1.172] ([199.203.120.178]) by mx.google.com with ESMTPSA id h3sm20883342wjn.10.2014.08.15.12.14.42 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 15 Aug 2014 12:14:43 -0700 (PDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Yoav Nir In-Reply-To: <6EB355AE-2158-4405-BA3C-7F8CB0599B14@apple.com> Date: Fri, 15 Aug 2014 22:14:40 +0300 Content-Transfer-Encoding: quoted-printable Message-Id: <2867DFF9-C21A-4008-9DC9-F97EDD3D722F@gmail.com> References: <3DD81803-39CF-42D7-AB71-CC3813E7EDAB@gmail.com> <82EA5C58-0A89-4077-BBF4-68E9367E3CE6@gmail.com> <81DED1F2-4FC0-4AF1-A780-98060D663A4C@hp.com> <53EE52EC.3060003@gmx.de> <6EB355AE-2158-4405-BA3C-7F8CB0599B14@apple.com> To: Michael Sweet X-Mailer: Apple Mail (2.1878.6) Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/r294C89akUqTGlIY5gMtzvKtQs8 Cc: Julian Reschke , IETF HTTP Auth Subject: Re: [http-auth] Modifications to Basic & Digest X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Aug 2014 19:14:47 -0000 As a matter of process, an IANA registry does not necessarily imply = needing an RFC. =93First come first serve=94 and =93expert review=94 are valid IANA = registry policies. Yoav On Aug 15, 2014, at 9:59 PM, Michael Sweet wrote: > Julian, >=20 > An IANA registry for parameters would work. Needing a spec/RFC for it = can be problematic (since publishing through the IETF is not a fast = process and far from a sure thing, even for an informational document), = but if we can register a parameter then at least people know about it. >=20 >=20 > On Aug 15, 2014, at 2:35 PM, Julian Reschke = wrote: >=20 >> As author of the Basic spec, I'm *very* -1 on adding anything new = that is not essential. >>=20 >> We can discuss an IANA registry for parameters, but adding something = experimental at this point doesn't make any sense to me. >>=20 >> Best regards, Julian >>=20 >>=20 >> On 2014-08-15 07:24, Kennedy, Smith (Wireless Architect) wrote: >>> +1 for #2. >>>=20 >>> Smith >>>=20 >>> /** >>> Smith Kennedy >>> ATB Wireless Architect - PPS >>> Hewlett-Packard Co. >>> */ >>>=20 >>>=20 >>>=20 >>>=20 >>> On 2014-08-13, at 10:48 PM, Yoav Nir >> > wrote: >>>=20 >>>> Hi folks >>>>=20 >>>> Based on both the responses to this thread and previous threads = about >>>> specific enhancements, I think we can call this. >>>>=20 >>>> There were no posts saying that we absolutely should not make any >>>> changes to Basic and Digest. There were some people who said these >>>> changes were worthwhile, and others who thought it didn=92t add = much. >>>> There were none in the =93this makes things worse=94 camp. >>>>=20 >>>> So I think we can call consensus on allowing changes (in general). >>>>=20 >>>> About the two proposals for changes: >>>>=20 >>>> 1. Add username hashing to Digest: there are more people who want = this >>>> than there are people who care enough to say that they don=92t = care. >>>> There is also some implementation and deployment experience. And it >>>> also serves a privacy purpose by reducing the amount of personal >>>> information sent over the wire. So I think we can call this as >>>> accepted by the group. Since this modification is already in the >>>> draft, there are no action items here for Rifaat, David, and = Sophie. >>>>=20 >>>> 2. Adding username suggestion by the server to Basic. So far I only >>>> see one person advocating it. Anyone else? >>>>=20 >>>> If people in the group think I=92m misreading this, please let us = know >>>> on-list soon. >>>>=20 >>>> Thanks >>>>=20 >>>> Yoav >>>>=20 >>>> On Jul 24, 2014, at 6:24 PM, Yoav Nir >>> > wrote: >>>>=20 >>>>> Hi >>>>>=20 >>>>> A question we raised at the HTTP-Auth meeting today was whether or >>>>> not we=92d like to make any changes to Basic and Digest. >>>>>=20 >>>>> The charter requires us to add to things to these protocols: >>>>>=20 >>>>> 1. Adding internationalization support for user names and = passwords >>>>> 2. Adding modern hash functions to Digest so that an = implementation >>>>> does not depend on MD5. >>>>>=20 >>>>>=20 >>>>> There are a few additional extensions proposed. The Digest draft >>>>> includes optional username hashing, which (when used) will prevent >>>>> the cleartext username from being sent on the wire. This sounds = (to >>>>> me) to be a good idea privacy-wise, but there is a claim that = Basic >>>>> and Digest are so horribly broken anyway, that we don=92t want to = add >>>>> security features to them, even if said security features seem = like a >>>>> good idea (hence the =93lipstick on a pig=94 comment I made at the >>>>> session [1]). >>>>>=20 >>>>> So the question I=92m asking the group here is, do we want to = tinker >>>>> with Basic and Digest, potentially making them somewhat better, or = do >>>>> we want to clamp down on all such discussion, and stick only to = the >>>>> mandates in the charter? >>>>>=20 >>>>> Yoav >>>>>=20 >>>>> [1] >>>>> >>>>=20 >>>> _______________________________________________ >>>> http-auth mailing list >>>> http-auth@ietf.org >>>> https://www.ietf.org/mailman/listinfo/http-auth >>>=20 >>>=20 >>>=20 >>> _______________________________________________ >>> http-auth mailing list >>> http-auth@ietf.org >>> https://www.ietf.org/mailman/listinfo/http-auth >>>=20 >>=20 >> _______________________________________________ >> http-auth mailing list >> http-auth@ietf.org >> https://www.ietf.org/mailman/listinfo/http-auth >=20 > _________________________________________________________ > Michael Sweet, Senior Printing System Engineer, PWG Chair >=20 From nobody Fri Aug 15 13:17:27 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4948B1A03EA for ; Fri, 15 Aug 2014 13:17:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.969 X-Spam-Level: X-Spam-Status: No, score=-4.969 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.668, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hx1gYLRlRPT8 for ; Fri, 15 Aug 2014 13:17:22 -0700 (PDT) Received: from mail-in2.apple.com (mail-out2.apple.com [17.151.62.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7CFAB1A0389 for ; Fri, 15 Aug 2014 13:17:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=apple.com; s=mailout2048s; c=relaxed/simple; q=dns/txt; i=@apple.com; t=1408133841; x=2272047441; h=From:Sender:Reply-To:Subject:Date:Message-id:To:Cc:MIME-version:Content-type: Content-transfer-encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-reply-to:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=bcmqxmYuVOQo4xo9xRxyH4x+Al/fHjHEDOuVDI722Jw=; b=n41FTqPqeHF2GQba1mAGkvzvQ6EEliJXLVD85YttzriIvaliGkB98wg/qIGan2zY 9REmIbcWYWOmrx6fd4sMM22cRbhV4uwmcrsfPCTaSbt4ZopGvF0NH4oCAINSqSvw kbzYT05kOJ3kK/1+pKf/HXoHfqlUUJiwTJZgKydaEeUtWGjVE9XUc7EFMow+hVWJ rxC5wULH3lT0eh4Ed2UQwsDhxXwI9Y4hQWzFMK6lInbeL2hc+HLa7++tfI+5YIvc bXuV32om758o8c4qBOok23zdHtPgyuhYJXNd+UhPA35lCcbAMWrXv5WQunBYlqO4 7PdUWEqUuKRKV5QLz/ePIw==; Received: from mail-out.apple.com (mail-out.apple.com [17.151.62.50]) (using TLS with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by mail-in2.apple.com (Apple Secure Mail Relay) with SMTP id B3.9C.21801.1DA6EE35; Fri, 15 Aug 2014 13:17:21 -0700 (PDT) MIME-version: 1.0 Content-type: text/plain; charset=windows-1252 Received: from relay6.apple.com ([17.128.113.90]) by local.mail-out.apple.com (Oracle Communications Messaging Server 7.0.5.30.0 64bit (built Oct 22 2013)) with ESMTP id <0NAD0063F70LSZS1@local.mail-out.apple.com> for http-auth@ietf.org; Fri, 15 Aug 2014 13:17:21 -0700 (PDT) X-AuditID: 11973e11-f797c6d000005529-48-53ee6ad10176 Received: from cardamom.apple.com (cardamom.apple.com [17.128.115.94]) (using TLS with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by relay6.apple.com (Apple SCV relay) with SMTP id 75.ED.30921.2CA6EE35; Fri, 15 Aug 2014 13:17:07 -0700 (PDT) Received: from [17.153.60.11] by cardamom.apple.com (Oracle Communications Messaging Server 7.0.5.30.0 64bit (built Oct 22 2013)) with ESMTPSA id <0NAD00BCX70WLA10@cardamom.apple.com> for http-auth@ietf.org; Fri, 15 Aug 2014 13:17:21 -0700 (PDT) From: Michael Sweet In-reply-to: <2867DFF9-C21A-4008-9DC9-F97EDD3D722F@gmail.com> Date: Fri, 15 Aug 2014 16:17:19 -0400 Content-transfer-encoding: quoted-printable Message-id: References: <3DD81803-39CF-42D7-AB71-CC3813E7EDAB@gmail.com> <82EA5C58-0A89-4077-BBF4-68E9367E3CE6@gmail.com> <81DED1F2-4FC0-4AF1-A780-98060D663A4C@hp.com> <53EE52EC.3060003@gmx.de> <6EB355AE-2158-4405-BA3C-7F8CB0599B14@apple.com> <2867DFF9-C21A-4008-9DC9-F97EDD3D722F@gmail.com> To: Yoav Nir X-Mailer: Apple Mail (2.1878.6) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrPLMWRmVeSWpSXmKPExsUiON3OSPdi1rtgg/1frS0+7J/D5MDosWTJ T6YAxigum5TUnMyy1CJ9uwSujMe/JjIXrNaq6Pk5i6WB8ahSFyMnh4SAicT6W5/YIWwxiQv3 1rN1MXJxCAnMYpJ4deoOC0iCV0BQ4sfke0A2BwezgJ7E/YtaEDUzmSRuTupjgxl09f4bRojE RCaJB8t6oSb9ZpS4fu8tWLewgIXEpAZPkAY2ATWJ35P6WEFsTgFbiW8tJ8FsFgFVibdXuphB epkFJjJK/J22DyzBLKAt8eTdBVaIi2wkeg+uZYdYMJ9JYu7dyWCniggoSRy+8pUZ4iR5iQ8f joMVSQh8Z5W40rmJfQKjyCwkL81CeGkWkh0LGJlXMQrlJmbm6GbmGeklFhTkpOol5+duYoSE uOAOxuOrrA4xCnAwKvHwCoi/CxZiTSwrrsw9xCjNwaIkzivn+DZYSCA9sSQ1OzW1ILUovqg0 J7X4ECMTB6dUA+MUC460PgbjSdPztLTaH7YWvZ1SqujW63f9w6u2HGe50s/CzU9tU+MMZrf8 XFycu+Li8uf3JHew58sdaphZf4v16URvq2MT9sr7HN9la9vYvmKyi+OB9jmf/TjWCRlwTZec wJX9Sl4h+toqRv1tfXHC119YHjI+8Ub1H9/xrdufTNxrVBrge1WJpTgj0VCLuag4EQDwV0bN UgIAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrKLMWRmVeSWpSXmKPExsUi2FAcp3s4612wwfqpTBYf9s9hcmD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxuNfE5kLVmtV9PycxdLAeFSpi5GTQ0LAROLq/TeMELaYxIV7 69m6GLk4hAQmMknc2XONEcL5zShx/d5bli5GDg5hAQuJSQ2eIA28AgYSr34+ZgYJMwvoSdy/ qAUSZhNQk/g9qY8VxOYUsJX41nISzGYRUJV4e6WLGWQks8BERom/0/aBJZgFtCWevLvACjHT RqL34Fp2iL3zmSTm3p3MApIQEVCSOHzlKzPEpfISHz4cZ5/AKDALyR2zEO6YhWTsAkbmVYwC Rak5iZVmeokFBTmpesn5uZsYwYFXGLWDsWG51SFGAQ5GJR7eDMl3wUKsiWXFlbmHGCU4mJVE eFe5AYV4UxIrq1KL8uOLSnNSiw8xSnOwKInzensApQTSE0tSs1NTC1KLYLJMHJxSDYxCJ9f/ Fqu8cov9tMedTwdvzpH73Vai91I/S9dsttjO3WE8c1PiTD3W59dOiDDgMWPUvSmbXtShGR04 a1nL/uPHO88Ws81e8/bGhrJ7j18Vrd6y9dPr9dNKGQVufCmauv962eGz2nPeRcxYMzeTR5NH hUX84qI+9S8Pj21MuDz3S9zb2Oc9We+3KLEUZyQaajEXFScCAIt+/1A4AgAA Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/qROu6h6MuNrYxrLNjO289ZiNoKY Cc: Julian Reschke , IETF HTTP Auth Subject: Re: [http-auth] Modifications to Basic & Digest X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Aug 2014 20:17:24 -0000 Right, but the current text specifies that a new spec needs to be = written. I am totally OK with a registry and expert review (that's what = we use for IPP...) On Aug 15, 2014, at 3:14 PM, Yoav Nir wrote: > As a matter of process, an IANA registry does not necessarily imply = needing an RFC. >=20 > =93First come first serve=94 and =93expert review=94 are valid IANA = registry policies. >=20 > Yoav >=20 > On Aug 15, 2014, at 9:59 PM, Michael Sweet wrote: >=20 >> Julian, >>=20 >> An IANA registry for parameters would work. Needing a spec/RFC for = it can be problematic (since publishing through the IETF is not a fast = process and far from a sure thing, even for an informational document), = but if we can register a parameter then at least people know about it. >>=20 >>=20 >> On Aug 15, 2014, at 2:35 PM, Julian Reschke = wrote: >>=20 >>> As author of the Basic spec, I'm *very* -1 on adding anything new = that is not essential. >>>=20 >>> We can discuss an IANA registry for parameters, but adding something = experimental at this point doesn't make any sense to me. >>>=20 >>> Best regards, Julian >>>=20 >>>=20 >>> On 2014-08-15 07:24, Kennedy, Smith (Wireless Architect) wrote: >>>> +1 for #2. >>>>=20 >>>> Smith >>>>=20 >>>> /** >>>> Smith Kennedy >>>> ATB Wireless Architect - PPS >>>> Hewlett-Packard Co. >>>> */ >>>>=20 >>>>=20 >>>>=20 >>>>=20 >>>> On 2014-08-13, at 10:48 PM, Yoav Nir >>> > wrote: >>>>=20 >>>>> Hi folks >>>>>=20 >>>>> Based on both the responses to this thread and previous threads = about >>>>> specific enhancements, I think we can call this. >>>>>=20 >>>>> There were no posts saying that we absolutely should not make any >>>>> changes to Basic and Digest. There were some people who said these >>>>> changes were worthwhile, and others who thought it didn=92t add = much. >>>>> There were none in the =93this makes things worse=94 camp. >>>>>=20 >>>>> So I think we can call consensus on allowing changes (in general). >>>>>=20 >>>>> About the two proposals for changes: >>>>>=20 >>>>> 1. Add username hashing to Digest: there are more people who want = this >>>>> than there are people who care enough to say that they don=92t = care. >>>>> There is also some implementation and deployment experience. And = it >>>>> also serves a privacy purpose by reducing the amount of personal >>>>> information sent over the wire. So I think we can call this as >>>>> accepted by the group. Since this modification is already in the >>>>> draft, there are no action items here for Rifaat, David, and = Sophie. >>>>>=20 >>>>> 2. Adding username suggestion by the server to Basic. So far I = only >>>>> see one person advocating it. Anyone else? >>>>>=20 >>>>> If people in the group think I=92m misreading this, please let us = know >>>>> on-list soon. >>>>>=20 >>>>> Thanks >>>>>=20 >>>>> Yoav >>>>>=20 >>>>> On Jul 24, 2014, at 6:24 PM, Yoav Nir >>>> > wrote: >>>>>=20 >>>>>> Hi >>>>>>=20 >>>>>> A question we raised at the HTTP-Auth meeting today was whether = or >>>>>> not we=92d like to make any changes to Basic and Digest. >>>>>>=20 >>>>>> The charter requires us to add to things to these protocols: >>>>>>=20 >>>>>> 1. Adding internationalization support for user names and = passwords >>>>>> 2. Adding modern hash functions to Digest so that an = implementation >>>>>> does not depend on MD5. >>>>>>=20 >>>>>>=20 >>>>>> There are a few additional extensions proposed. The Digest draft >>>>>> includes optional username hashing, which (when used) will = prevent >>>>>> the cleartext username from being sent on the wire. This sounds = (to >>>>>> me) to be a good idea privacy-wise, but there is a claim that = Basic >>>>>> and Digest are so horribly broken anyway, that we don=92t want to = add >>>>>> security features to them, even if said security features seem = like a >>>>>> good idea (hence the =93lipstick on a pig=94 comment I made at = the >>>>>> session [1]). >>>>>>=20 >>>>>> So the question I=92m asking the group here is, do we want to = tinker >>>>>> with Basic and Digest, potentially making them somewhat better, = or do >>>>>> we want to clamp down on all such discussion, and stick only to = the >>>>>> mandates in the charter? >>>>>>=20 >>>>>> Yoav >>>>>>=20 >>>>>> [1] >>>>>> >>>>>=20 >>>>> _______________________________________________ >>>>> http-auth mailing list >>>>> http-auth@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/http-auth >>>>=20 >>>>=20 >>>>=20 >>>> _______________________________________________ >>>> http-auth mailing list >>>> http-auth@ietf.org >>>> https://www.ietf.org/mailman/listinfo/http-auth >>>>=20 >>>=20 >>> _______________________________________________ >>> http-auth mailing list >>> http-auth@ietf.org >>> https://www.ietf.org/mailman/listinfo/http-auth >>=20 >> _________________________________________________________ >> Michael Sweet, Senior Printing System Engineer, PWG Chair >>=20 >=20 _________________________________________________________ Michael Sweet, Senior Printing System Engineer, PWG Chair From nobody Fri Aug 15 14:32:59 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 913AF1A06E4 for ; Fri, 15 Aug 2014 14:32:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qJXh16PdRT9L for ; Fri, 15 Aug 2014 14:32:57 -0700 (PDT) Received: from mail-we0-x22e.google.com (mail-we0-x22e.google.com [IPv6:2a00:1450:400c:c03::22e]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E7371A06E1 for ; Fri, 15 Aug 2014 14:32:57 -0700 (PDT) Received: by mail-we0-f174.google.com with SMTP id x48so2821434wes.19 for ; Fri, 15 Aug 2014 14:32:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=m5kU6Hwi/MoDeGPTuXcHTvmD/346XPMkSMOXZWPi/TQ=; b=M8T/hyVljT6y3NAa3O2TI0ErTvIkEiwJFMIgChMpiQxUCFHZBBTDI7R43bJm8rtamZ n7pw7VnQyqR62VrFBMaFmLvFwtoYYsAVSyjpKE5WMqF2do6rfgbyzu288V7GO7wkYjUZ l4FNhX1xX1sofwif50DHhA7UQ/HwyMpQq/W1QyTuVYcvZ/TOvo+H94+VkMFb6/8oZ8wW VThQhWpZot47Qace/TDbLZ2GsG5SIFTaZAYCPgmQa1HzzKF0dbRhqi5WgJpD4qdqFU2f 5Pegm+v2kGgzJIo1cHFuG/7IPr5a8byocBTREJEDa6nQs/rV96dviuAkYp0lDBYXs7pL jW6g== MIME-Version: 1.0 X-Received: by 10.194.78.100 with SMTP id a4mr21567160wjx.106.1408138375738; Fri, 15 Aug 2014 14:32:55 -0700 (PDT) Received: by 10.216.13.130 with HTTP; Fri, 15 Aug 2014 14:32:55 -0700 (PDT) Date: Fri, 15 Aug 2014 17:32:55 -0400 Message-ID: From: Matthew Lepinski To: "http-auth@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/S59zI0oB9HAbVqmPu49arLvw2rE Subject: [http-auth] Draft Minutes Posted for IETF 90 X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Aug 2014 21:32:58 -0000 Draft minutes have been posted for the HTTP-AUTH session at IETF 90. http://www.ietf.org/proceedings/90/minutes/minutes-90-httpauth If you have any corrections that should be made to the minutes, please let us know. - Yoav and Matt From nobody Mon Aug 18 19:26:39 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25C041A87A4; Mon, 18 Aug 2014 19:26:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 94mveopkXFe6; Mon, 18 Aug 2014 19:26:33 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B2F911A879F; Mon, 18 Aug 2014 19:26:33 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.6.2.p5 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140819022633.9673.51211.idtracker@ietfa.amsl.com> Date: Mon, 18 Aug 2014 19:26:33 -0700 Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/i1xw7n7U7Ipym2Q0P73CnQ7t-Ow Cc: http-auth@ietf.org Subject: [http-auth] I-D Action: draft-ietf-httpauth-mutual-03.txt X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Aug 2014 02:26:35 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF. Title : Mutual Authentication Protocol for HTTP Authors : Yutaka Oiwa Hajime Watanabe Hiromitsu Takagi Kaoru Maeda Tatsuya Hayashi Yuichi Ioku Filename : draft-ietf-httpauth-mutual-03.txt Pages : 52 Date : 2014-08-18 Abstract: This document specifies a mutual authentication method for the Hyper- text Transfer Protocol (HTTP). This method provides a true mutual authentication between an HTTP client and an HTTP server using password-based authentication. Unlike the Basic and Digest authentication methods, the Mutual authentication method specified in this document assures the user that the server truly knows the user's encrypted password. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-httpauth-mutual/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-httpauth-mutual-03 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-mutual-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Aug 18 19:28:57 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB9C11A87AE; Mon, 18 Aug 2014 19:28:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PQqLF_ZCZRpX; Mon, 18 Aug 2014 19:28:47 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EBB01A878C; Mon, 18 Aug 2014 19:28:47 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.6.2.p5 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140819022847.927.27146.idtracker@ietfa.amsl.com> Date: Mon, 18 Aug 2014 19:28:47 -0700 Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/n0pmik3Bh7suPf466-6zGKCjD4w Cc: http-auth@ietf.org Subject: [http-auth] I-D Action: draft-ietf-httpauth-mutual-algo-01.txt X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Aug 2014 02:28:49 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF. Title : Mutual Authentication Protocol for HTTP: KAM3-based Cryptographic Algorithms Authors : Yutaka Oiwa Hajime Watanabe Hiromitsu Takagi Kaoru Maeda Tatsuya Hayashi Yuichi Ioku Filename : draft-ietf-httpauth-mutual-algo-01.txt Pages : 16 Date : 2014-08-18 Abstract: This document specifies some cryptographic algorithms which will be used for the Mutual user authentication method for the Hyper-text Transport Protocol (HTTP). The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-httpauth-mutual-algo/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-httpauth-mutual-algo-01 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-mutual-algo-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Aug 18 19:29:16 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65BB61A87BA; Mon, 18 Aug 2014 19:29:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nxes5TtbTRv9; Mon, 18 Aug 2014 19:29:07 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id F3DAB1A87A6; Mon, 18 Aug 2014 19:29:06 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.6.2.p5 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140819022906.8274.69673.idtracker@ietfa.amsl.com> Date: Mon, 18 Aug 2014 19:29:06 -0700 Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/J4MnV8vCWex8i7CPRSXm1yMVngk Cc: http-auth@ietf.org Subject: [http-auth] I-D Action: draft-ietf-httpauth-extension-02.txt X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Aug 2014 02:29:08 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF. Title : HTTP Authentication Extensions for Interactive Clients Authors : Yutaka Oiwa Hajime Watanabe Hiromitsu Takagi Tatsuya Hayashi Yuichi Ioku Filename : draft-ietf-httpauth-extension-02.txt Pages : 24 Date : 2014-08-18 Abstract: This document specifies a few extensions of HTTP authentication framework for interactive clients. Recently, fundamental features of HTTP-level authentication is not enough for complex requirements of various Web-based applications. This makes these applications to implement their own authentication frameworks using HTML Forms and other means, which becomes one of the hurdles against introducing secure authentication mechanisms handled jointly by servers and user- agent clients. The extended framework fills gaps between Web application requirements and HTTP authentication provisions to solve the above problems, while maintaining compatibility against existing Web and non-Web uses of HTTP authentications. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-httpauth-extension/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-httpauth-extension-02 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-extension-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Aug 18 21:32:09 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DB891A87CE for ; Mon, 18 Aug 2014 21:32:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.679 X-Spam-Level: X-Spam-Status: No, score=-3.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M-Gz5dtTxPKl for ; Mon, 18 Aug 2014 21:32:04 -0700 (PDT) Received: from na3sys010aog112.obsmtp.com (na3sys010aog112.obsmtp.com [74.125.245.92]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 456211A87CD for ; Mon, 18 Aug 2014 21:32:04 -0700 (PDT) Received: from mail-vc0-f175.google.com ([209.85.220.175]) (using TLSv1) by na3sys010aob112.postini.com ([74.125.244.12]) with SMTP ID DSNKU/LTQ6K09fDLAfI8sISnqAQfqsGA7d6h@postini.com; Mon, 18 Aug 2014 21:32:04 PDT Received: by mail-vc0-f175.google.com with SMTP id ik5so6778690vcb.20 for ; Mon, 18 Aug 2014 21:32:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aist.go.jp; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type; bh=j4cCr62Inl9bxanqQghtRalTa9CStNToQ++6TsrUms8=; b=D7brnkFIasmamZK8FnSrFdgZ/PpqX0C1GbTowU2IDfI92b4c/OWcN9Y4cBE8DgzAGU b/GLXHs14Xe/E6Ut2jfkkc67v0XAJ/t8SbpNvO7PlbdkIthaTyYsMvZZSFgG2RDoECGF QveFY96loCAVQsFuEB3h2a7do2T2xsZzICnuQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:content-type; bh=j4cCr62Inl9bxanqQghtRalTa9CStNToQ++6TsrUms8=; b=N9IVX4mWsflSyfLnZolAfRkOh/q97PhtpvmoBD/hWnq4tjy08kzPVriLCaqLF0Uj2t 3XUK8URhV3wjNH/C85C7nHonhaZ2UB88avsURj1AoeBa0PG1eh8dZzpAtFwf9cT6D5+r ZczDNMlmfV6sr4tBLHUfJSqbpE/FQUbYDUfKUJVY4UP41o1kEE7NCLdzgHgikmYy/Ivw WJ5G16Pw/aifzRnGgguJ8s0NmwTNDlfXGTwHINDevunVHoWX0Aj04p/NDWzQn0uSGbB4 9cRPlQELRR/jIQzRUJKlR8lF+xxtPUaAMnP0l8mk4KLUn4H9fsJHuf79VM5u5Osk4Jx7 ft/Q== X-Gm-Message-State: ALoCoQn2P1cu7cF4jKBS/qr2uVc07WWCvzXAS/SxYEFgiIXAsRxI7cmKFLgnHXio4NeZBbqkMFzZHrLWMD8aFa8OH9+KoViVaTaFOkEYbYK4YOTPz3w13JeSZYCbnPNdF1cJsbUqjfGF X-Received: by 10.220.159.204 with SMTP id k12mr27947351vcx.15.1408422723072; Mon, 18 Aug 2014 21:32:03 -0700 (PDT) X-Received: by 10.220.159.204 with SMTP id k12mr27947345vcx.15.1408422722927; Mon, 18 Aug 2014 21:32:02 -0700 (PDT) MIME-Version: 1.0 Received: by 10.220.124.72 with HTTP; Mon, 18 Aug 2014 21:31:42 -0700 (PDT) In-Reply-To: <20140819022906.8274.69673.idtracker@ietfa.amsl.com> References: <20140819022906.8274.69673.idtracker@ietfa.amsl.com> From: Yutaka OIWA Date: Tue, 19 Aug 2014 13:31:42 +0900 Message-ID: To: "http-auth@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/UYKJ4Be1fAOZyPpbDSe1RvbSsyc Subject: Re: [http-auth] I-D Action: draft-ietf-httpauth-extension-02.txt X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Aug 2014 04:32:07 -0000 Dear all, as promised in Toronto, I submitted the revised version of httpauth-extension draft. In this revision, the following are changed: * Multiple scheme challenge is supported, and * Added the "realm" parameter. These look like the following: (use of obsolete multi-line header is for line-wrapping readability only) WWW-Authenticate: Basic realm="test", Basic realm="test2", Digest realm="test", qop=int, ... Authentication-Control: Basic realm="test", auth-style=modal, Basic realm="test2", no-auth=true, Digest realm="test", auth-style=modal * Support for username which is the same as the Michael's proposal for non-Basic auth schemes as well. WWW-Authenticate: Digest realm="test", qop=int, ... Authentication-Control: Digest realm="test", username="admin" 2014-08-19 11:29 GMT+09:00 : > > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF. > > Title : HTTP Authentication Extensions for Interactive Clients > Authors : Yutaka Oiwa > Hajime Watanabe > Hiromitsu Takagi > Tatsuya Hayashi > Yuichi Ioku > Filename : draft-ietf-httpauth-extension-02.txt > Pages : 24 > Date : 2014-08-18 > > Abstract: > This document specifies a few extensions of HTTP authentication > framework for interactive clients. Recently, fundamental features of > HTTP-level authentication is not enough for complex requirements of > various Web-based applications. This makes these applications to > implement their own authentication frameworks using HTML Forms and > other means, which becomes one of the hurdles against introducing > secure authentication mechanisms handled jointly by servers and user- > agent clients. The extended framework fills gaps between Web > application requirements and HTTP authentication provisions to solve > the above problems, while maintaining compatibility against existing > Web and non-Web uses of HTTP authentications. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-httpauth-extension/ > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-ietf-httpauth-extension-02 > > A diff from the previous version is available at: > http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-extension-02 > > > Please note that it may take a couple of minutes from the time of submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth -- Yutaka OIWA, Ph.D. Leader, System Life-cycle Research Group Research Institute for Secure Systems (RISEC) National Institute of Advanced Industrial Science and Technology (AIST) Mail addresses: , OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D 3139 8677 9BD2 4405 46B5] From nobody Mon Aug 18 21:36:36 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31B431A87CD for ; Mon, 18 Aug 2014 21:36:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.679 X-Spam-Level: X-Spam-Status: No, score=-3.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xi1f5sYqlK8a for ; Mon, 18 Aug 2014 21:36:32 -0700 (PDT) Received: from na3sys010aog106.obsmtp.com (na3sys010aog106.obsmtp.com [74.125.245.80]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9ABF01A87D1 for ; Mon, 18 Aug 2014 21:36:32 -0700 (PDT) Received: from mail-vc0-f174.google.com ([209.85.220.174]) (using TLSv1) by na3sys010aob106.postini.com ([74.125.244.12]) with SMTP ID DSNKU/LUUDo7DkoDWT+TOJVTDua32DyU+nrF@postini.com; Mon, 18 Aug 2014 21:36:32 PDT Received: by mail-vc0-f174.google.com with SMTP id la4so6840553vcb.19 for ; Mon, 18 Aug 2014 21:36:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aist.go.jp; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type; bh=1N4hg+K64EB0c/DYQCEV/EqjAdTjCF/Z8CW9flCnbMA=; b=eSu7H0PWNaGyaQgLmw8QGsJasfYonJRiTAuZMypH3mpzsjMB6pJmHA4mz36pBuBAWR i113aweQrvcQKUMswtCVeiImB1jev9Lg/XP+3zdQ8qRB1BOsAwSTW/swOFhv64zxW/+p O/rvjxbDNmjzKTUZTt8Jv07tMwS/CkPv5QKZs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:content-type; bh=1N4hg+K64EB0c/DYQCEV/EqjAdTjCF/Z8CW9flCnbMA=; b=SuLZ4J0sNAw1qQgbV10ZVpQcTliblhLc/lc9jrz/NNnBp3PhPM5TewtYumteiVjpC1 nNeVKSk4cBX4lsEkT1YpvCXmOtMs3Tr5Ni7M1ioXclH81G6HmLYAD8MvDEk2XXCZnB+N pcaKuEELpI7m5d9Z2U/Q3a1tfxGEpdtXjtsam4WpldLyk7l01jZkC7Bt9+edyNR7kcCf WqALCIcqY1ToAWYa/JnvYszZ9HwPdScAPrEzAjiuXlpXCTm50lJ+DNifCnE6PPZQYMt9 4JOq79eqtsjZIhGACyKD4RkcV7DGQlsqcHr/KKFbsHn7MMb5DzCnKk1bvJNv0K9hPJjR gWdQ== X-Gm-Message-State: ALoCoQlDRnOaNbLjtDDlLpfbTaDaFUs4u49BqJk5P11NSGQHlsCn0IfzdZB+gqeWKhseVWJDYz/qdlbWaeOhgqPGDq7YhRK0rAH+jwCcW9U9o6xQJSiDA7CPqWm+6EC3vbWxHtqHVSY1 X-Received: by 10.220.184.70 with SMTP id cj6mr28256284vcb.5.1408422991680; Mon, 18 Aug 2014 21:36:31 -0700 (PDT) X-Received: by 10.220.184.70 with SMTP id cj6mr28256274vcb.5.1408422991528; Mon, 18 Aug 2014 21:36:31 -0700 (PDT) MIME-Version: 1.0 Received: by 10.220.124.72 with HTTP; Mon, 18 Aug 2014 21:36:11 -0700 (PDT) In-Reply-To: <20140819022633.9673.51211.idtracker@ietfa.amsl.com> References: <20140819022633.9673.51211.idtracker@ietfa.amsl.com> From: Yutaka OIWA Date: Tue, 19 Aug 2014 13:36:11 +0900 Message-ID: To: "http-auth@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/V_3EtHwVClaWbcOCfyuzFS2YCbk Subject: Re: [http-auth] I-D Action: draft-ietf-httpauth-mutual-03.txt X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Aug 2014 04:36:34 -0000 Dear all, I updated the mutual and mutual-algo drafts as well. The mutual draft updates the single-port auth-realm syntax to be exactly same as the Web-Origin syntax, closing ticket #4. The algo draft reflects the discussion on this list for security analysis around K_s1. It also incorporates "figure-based" description of the exchanges, addressing for ticket #9. In addition, references to HTTPBIS drafts are happily updated to the published RFC :-) 2014-08-19 11:26 GMT+09:00 : > > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF. > > Title : Mutual Authentication Protocol for HTTP > Authors : Yutaka Oiwa > Hajime Watanabe > Hiromitsu Takagi > Kaoru Maeda > Tatsuya Hayashi > Yuichi Ioku > Filename : draft-ietf-httpauth-mutual-03.txt > Pages : 52 > Date : 2014-08-18 > > Abstract: > This document specifies a mutual authentication method for the Hyper- > text Transfer Protocol (HTTP). This method provides a true mutual > authentication between an HTTP client and an HTTP server using > password-based authentication. Unlike the Basic and Digest > authentication methods, the Mutual authentication method specified in > this document assures the user that the server truly knows the user's > encrypted password. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-httpauth-mutual/ > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-ietf-httpauth-mutual-03 > > A diff from the previous version is available at: > http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-mutual-03 > > > Please note that it may take a couple of minutes from the time of submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth -- Yutaka OIWA, Ph.D. Leader, System Life-cycle Research Group Research Institute for Secure Systems (RISEC) National Institute of Advanced Industrial Science and Technology (AIST) Mail addresses: , OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D 3139 8677 9BD2 4405 46B5] From nobody Sat Aug 23 04:52:25 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 402791A8763; Sat, 23 Aug 2014 04:52:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Snjf6cihm-02; Sat, 23 Aug 2014 04:52:22 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E34A1A6F9D; Sat, 23 Aug 2014 04:52:22 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.6.2.p5 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140823115222.21590.20013.idtracker@ietfa.amsl.com> Date: Sat, 23 Aug 2014 04:52:22 -0700 Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/DWY8vbXS5OnA6gICReVayxNbVQk Cc: http-auth@ietf.org Subject: [http-auth] I-D Action: draft-ietf-httpauth-digest-08.txt X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Aug 2014 11:52:23 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF. Title : HTTP Digest Access Authentication Authors : Rifaat Shekh-Yusef David Ahrens Sophie Bremer Filename : draft-ietf-httpauth-digest-08.txt Pages : 30 Date : 2014-08-23 Abstract: HTTP provides a simple challenge-response authentication mechanism that may be used by a server to challenge a client request and by a client to provide authentication information. This document defines the HTTP Digest Authentication scheme that may be used with the authentication mechanism. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-httpauth-digest-08 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-digest-08 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sat Aug 23 04:57:08 2014 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E00131A8760; Sat, 23 Aug 2014 04:57:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y1GMqxHshAhB; Sat, 23 Aug 2014 04:57:03 -0700 (PDT) Received: from mail-lb0-x230.google.com (mail-lb0-x230.google.com [IPv6:2a00:1450:4010:c04::230]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A2A11A8763; Sat, 23 Aug 2014 04:57:02 -0700 (PDT) Received: by mail-lb0-f176.google.com with SMTP id u10so10578133lbd.35 for ; Sat, 23 Aug 2014 04:57:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=QYtZBSIy+XMaWszeLE+0DPyMZuoivZ2UKCpwFD2r0gY=; b=tUr39eMdTQh7JILjF3Z3xYamwugIj8YJkhu+Vo8XE1WnUST6aKdv/QXdCJkcnDMK3q UJivsgZok0lkxdn2NccnPN4hhB5NAFdEgeLPnhOPfoRHIoc5j4G2bw3MEq55RijOk45W dr6xUjlMq6EPDt1wgM+FgmSLwm/3bx4zxytMTCfShBv3euSrHE0PNuYMrIAVV22JRefA G/coFGTEU43dNrCEaOAzfSFbcQdkfNrucVLXKQLQxcoSuDrUPoQueSwU5m2iXrtrd61o VmDOeMoQ2BktInmiAQaNcpabTQmWmlu2WQQcoH4ovfyRf5c8nFBQDpE1L7012KtGAy+R Ardg== MIME-Version: 1.0 X-Received: by 10.152.5.42 with SMTP id p10mr1480520lap.82.1408795020569; Sat, 23 Aug 2014 04:57:00 -0700 (PDT) Received: by 10.114.2.34 with HTTP; Sat, 23 Aug 2014 04:57:00 -0700 (PDT) In-Reply-To: <20140823115222.21590.20013.idtracker@ietfa.amsl.com> References: <20140823115222.21590.20013.idtracker@ietfa.amsl.com> Date: Sat, 23 Aug 2014 07:57:00 -0400 Message-ID: From: Rifaat Shekh-Yusef To: internet-drafts@ietf.org Content-Type: multipart/alternative; boundary=089e01419f5ec3308805014aa63b Archived-At: http://mailarchive.ietf.org/arch/msg/http-auth/CvneR2FBCP9Wt8Y7AiXg2hAmi6Q Cc: "http-auth@ietf.org" , i-d-announce@ietf.org Subject: Re: [http-auth] I-D Action: draft-ietf-httpauth-digest-08.txt X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Aug 2014 11:57:06 -0000 --089e01419f5ec3308805014aa63b Content-Type: text/plain; charset=ISO-8859-1 Hi, I have just submitted a new version of this draft with few minor editorial changes. I believe that the draft is now ready for WGLC. Regards, Rifaat On Sat, Aug 23, 2014 at 7:52 AM, wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Hypertext Transfer Protocol > Authentication Working Group of the IETF. > > Title : HTTP Digest Access Authentication > Authors : Rifaat Shekh-Yusef > David Ahrens > Sophie Bremer > Filename : draft-ietf-httpauth-digest-08.txt > Pages : 30 > Date : 2014-08-23 > > Abstract: > HTTP provides a simple challenge-response authentication mechanism > that may be used by a server to challenge a client request and by a > client to provide authentication information. This document defines > the HTTP Digest Authentication scheme that may be used with the > authentication mechanism. > > > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/ > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-ietf-httpauth-digest-08 > > A diff from the previous version is available at: > http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-digest-08 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth > --089e01419f5ec3308805014aa63b Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Hi,

I have just submitted a new version= of this draft with few minor editorial changes.
I believe that t= he draft is now ready for WGLC.

Regards,
=A0Rifaat



On Sat, Aug 23, 2014 at 7:52 AM, = <internet-= drafts@ietf.org> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
=A0This draft is a work item of the Hypertext Transfer Protocol Authenticat= ion Working Group of the IETF.

=A0 =A0 =A0 =A0 Title=A0 =A0 =A0 =A0 =A0 =A0: HTTP Digest Access Authentica= tion
=A0 =A0 =A0 =A0 Authors=A0 =A0 =A0 =A0 =A0: Rifaat Shekh-Yusef
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 David Ahrens
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 Sophie Bremer
=A0 =A0 =A0 =A0 Filename=A0 =A0 =A0 =A0 : draft-ietf-httpauth-digest-08.txt=
=A0 =A0 =A0 =A0 Pages=A0 =A0 =A0 =A0 =A0 =A0: 30
=A0 =A0 =A0 =A0 Date=A0 =A0 =A0 =A0 =A0 =A0 : 2014-08-23

Abstract:
=A0 =A0HTTP provides a simple challenge-response authentication mechanism =A0 =A0that may be used by a server to challenge a client request and by a<= br> =A0 =A0client to provide authentication information. This document defines<= br> =A0 =A0the HTTP Digest Authentication scheme that may be used with the
=A0 =A0authentication mechanism.




The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest= /

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-digest-08
A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-httpauth-= digest-08


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp= .ietf.org/internet-drafts/

_______________________________________________
http-auth mailing list
http-auth@ietf.org
https://www.ietf.org/mailman/listinfo/http-auth

--089e01419f5ec3308805014aa63b--